I think `security.js` is way too vague. Since this file isn't necessarily huge, I'd rather leave it here for now until we see how little bits of web vulnerability protection code (they may be dispersed in difference places of the request cycle) and the server.js file evolve. Then we should get a better idea of how things should be refactored.